Change or reset your password

Change your password on the Security tab of Settings when you know the current one. When you have forgotten it, reset it with a link that Coritan emails to you. Either way, every browser and script signed in to your account has to sign in again afterwards.

• To change the password: sign in to the dashboard and have your current password to hand.
• To reset it: have access to the inbox of the email address you sign in with. If you signed up with a Coritan mailbox, the link also goes to the recovery email you gave at sign-up.

A new password must have:

• 8–128 characters
• a lowercase letter and an uppercase letter
• a digit
• a character that is neither a letter nor a digit, such as ! or a space

1. In the sidebar, select Settings, then the Security tab.
2. In Change password, enter your Current password.
3. Enter the new password in New password and again in Confirm new password.
4. Select Change password.

1. On the sign-in page, select Forgot password?.
2. Enter your Email address. For a mailbox account, you can enter the recovery email instead.
3. If a verification check appears, complete it.
4. Select Send reset link.
5. Open the email from Coritan and select its link. The link works once, for one hour, and only the newest link you asked for works.
6. On Set a new password, enter the password in New password and again in Confirm new password.
7. Select Update password, then Sign in with the new password.

Coritan emails you to say the password changed. Every session on the account ends, the one in this browser included, so the dashboard asks you to sign in again with the new password. If you signed up with a Coritan mailbox, its password in mail apps changes to the new one too.

Incorrect current password

The Current password is wrong. If you have forgotten it, select Reset it by email under the form.

The new password is the same as the current one.

Choose a password you do not use already.

Password must contain at least one uppercase letter

The new password breaks one of the rules. The message names the rule, such as a missing digit or special character.

The two new passwords do not match.

Confirm new password differs from New password. Type both again.

The reset email does not arrive

Look in your spam folder. The page answers the same way whether or not an account uses the address, so check that you typed the address you sign in with. A suspended or closed account gets no email.

Too many requests for this action. Please wait and try again.

You asked for several links in a short time. Wait a quarter of an hour, then ask again.

This reset link is invalid or has expired. Request a new one below.

The link is older than an hour, was used already, or a newer link replaced it. Select Request a new link.

This link is missing its reset token. Open the link from the email in full, or request a new one.

The address in your browser was cut short. Open the link from the email again, or copy all of it.

• Sign in to your account
• Sign out and end sessions
• Turn on two-factor authentication

Change the password with POST /auth/me/password:

curl -X POST https://api.coritan.com/api/v1/auth/me/password \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"current_password": "old password", "new_password": "new password"}'

{"message": "Password changed successfully", "mailbox_synced": false}

mailbox_synced is true when your Coritan mailbox took the new password too. From then on, every token issued before the change answers 401 with Token invalidated by password change, the token that made the request included. Sign in again for new tokens. A wrong current password answers 401 Incorrect current password, and a password that breaks a rule answers 422 with the rule, such as Password must contain at least one digit.

Ask for a reset link with POST /auth/forgot-password and {"email": "alex@example.com"}. It needs no token, and it always answers {"ok": true, "message": "If an account exists for that address, a reset link is on its way"}. When the verification check is on, add its turnstile_token. Asking too often answers 429 with "error": "rate_limited".

The link in the email is https://www.coritan.com/update-password?token=.... Send its token with the new password to POST /auth/reset-password:

curl -X POST https://api.coritan.com/api/v1/auth/reset-password \
  -H "Content-Type: application/json" \
  -d '{"token": "token from the link", "new_password": "new password"}'

It answers {"ok": true, "message": "Password updated"}. An expired link answers 400 This reset link has expired. Request a new one., and a used or unknown one 400 Invalid reset token. A suspended or closed account answers 403 Account is suspended or closed.